WebCert+ Phishing Attempt

UPDATE: Definitely phishing.

I recently got an email ostensibly from Bank of America. It said I needed to sign up for their new “WebCert+” service and if I didn’t, my account would be suspended and imposed a hefty $45 reactivation fee. I received one email (which went to Spam) containing an embedded web form in which I was to fill out all kinds of personal information. And three others adjuring me to fill it out lest terrible things happen to me and my bank account.

I think this is a phishing attempt. I want to know if there are others getting the same thing and if anyone can confirm that it is illegitimate.

My first clue that it’s a phishing attempt is that it’s sent from alerts@bankofamericaalerts.0nlinereport.com. These days it’s so easy (right?) to spoof a FROM address, you wonder why more people don’t.

Second was the embedded form. Who sends embedded email forms? I should have to log into my account online and _then_ fill out the form.

But all of that is circumstantial.

Anyone else see this or can confirm that it is attempted thievery?